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In this paper, we present a semi- loss- tolerant strong quantum coin-flipping protocol using quantum 
non-demolition (QND) measurement, obtaining the recent best bias of 0.3536. Furthermore, we 
make use of the single photon as a single qubit avoiding the difficult implement of EPR resources, 
so that it is of great simplicity to construct three-party, four-party and a more normal N-party dice 
rolling protocol, including the parallel and serial ones different in time complexity. The protocol 
is fair in the sense that every player has the same probability of success in cheating attempts at 
biasing the outcome of the dice rolling. We also analyze explicit and optimal cheating strategies 
and get the best result among dice rolling protocols considering loss. 

PACS numbers: 03.67.Mn, 03.65.Ta 



I. INTRODUCTION 

Dice rolling (DR) in classical settings was extensively 
introduced in 1999 by Feige U[l]. It is a cryptographic 
problem firstly proposed by N Aharon and J Silman[2,], 
describing N remote distrustful parties must decide on 
a random string between and N — 1. There are two 
types of QDR protocol defined by [2j. Weak A^-sided 
QDR is the problem that N remote distrustful parties 
having to decide on a number between and — 1, such 
that: (i) each party is aware of any other party's preferred 
outcome. In particular, no two or more parties may share 
the same preference, (ii) If all parties are honest the 
probability of each outcome is equal to 1/N. While M- 
party strong A'-sided QDR is defined as the problem of M 
remote distrustful parties having to decide on a number 
between 1 and A", such that: (i) no party is aware of 
any other party's preferred outcome. In particular, any 
number of parties may share the same preference, (ii) If 
all parties are honest the probability of each outcome is 
equal to 1/A^. 

Obviously QDR is a generalization of Quantum Coin 
Flipping (QCF) which is also a cryptographic task firstly 
introduced by Blum in 1981 [s]. The goal of QCF is to 
enable two distrustful and spatially separated parties, 
usually referred as Alice and Bob, to generate a ran- 
dom bit whose value cannot be controlled by anyone of 
them. There are also two variants of QCF: "strong" CF 
(SCF)[5H9| and "weak" CF (WCF)[10-12]. In SCF each 
party is not aware of the other's preference for the coin's 
outcome, while in WCF the parties have opposite and 
known preferences. Obviously, every strong CF protocol 
can also be used to implement a weak CF protocol, but 
the converse statement is generally not true. The secu- 



rity of a CF protocol is quantified by the biases e^'^and 



e^'^(ieO, 1); if and P^^ are the maximal probabili- 
ties that a dishonest Alice or Bob can force the outcome 
i, then 
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In classical settings, given unlimited computational 
power, a dishonest party can always fully bias the out- 
come as he or she chooses, i.e., e = l/2[4]. In contrast, 
this is not the case in the quantum world. Unconditional 
secure coin flipping is possible to some extent. Although 
the results of Mayers [13j and Lo Chau[14] implied the im- 
possibility of perfect quantum coin flipping(the possibili- 
ties of both and 1 are all 1/2 no matter what strategies 
a cheater uses), it can help guarantee neither of the two 
parties can totally control the outcome (which is impos- 
sible by classical means). The first strong coin flipping 
protocol was provided by Aharanov et al.[5.] with a bias of 
0.414. Subsequently Ambainis[6[ as well as Spekkens and 
Rudolph [7] independently improved this bound to 0.25. 
Unfortunately it was proven by Kitaev[15] that any quan- 
tum strong coin flipping protocols can not enjoy a bias 
less than 0.207 and this bound has been saturated by 
Chailloux and Kerenidis's protocol[9]. Compared with 
quantum SCF, quantum WCF is less studied, Spekkens 
and Rudolph [11] firstly introduced a family of protocols 
with a bias of 0.207 and Mochon then improved it to 
0.192 and finally to any e > 0[12]. 

Although a lot of progresses have been made along the 
way of exploring the least bias protocols, there is a com- 
mon limit of previous results: practical issues were not 
taken into consideration. On imperfect practical condi- 
tions such as losses and noise in the quantum channel 
as well as in the quantum memory storage, many pro- 
tocols will totally fail. As the most common practical 
imperfection in the long distance communication, losses 
were firstly analyzed in devising new practical protocols. 



2 



In 2008, Berlin et al\T^{see also Ref.flT^) introduced a 
loss-tolerant SCF protocol with a relatively poor bias 0.4. 
Before long Aharon et al.[18] presented a family of loss- 
tolerant quantum coin flipping protocols which achieve a 
smaller bias than Berlin et al but at a small rate. Very re- 
cently, Andre Chailloux[l9| presented an improved loss- 
tolerant quantum coin flipping with bias 0.359, by ex- 
tending Berlin et aVs protocol by adding an encryption 
step. This result was slightly improved by Ma et aVs 
protocol[20i to 0.3536. 

Compared with all loss-tolerant SCF mentioned above, 
our protocol presented here obtains the recent best bias of 
0.3536, reproducing the result of the protocol in [20] using 
a single state with QND measurement which is easier to 
prepare in practice than EPR pairs used in [20]. After 
detailed analysis, we get the bias under fair condition as 
a function of p, where p is the probability that the qubit 
in the Bob's quantum memory storage is lost. When 
p approaches 0, thej)ias e{p) ^ 0.3525, which is equal 
to the protocol in |20| and also a best result over all 
the earlier loss-tolerant protocols [l|-[3|. We also show the 
bias will monotonously increase with a decreasing p. To 
achieve more flexibility and practical value, three-party 
DR protocol, four-party DR protocol and their extended 
form N-party DR protocol are given. 

After this introduction, the structure of the paper is 
organized as follows. We begin our protocol in Sec. 2 with 
a contrast to the protocol in [20]. In Sec. 3, We propose 
an impressive three-party DR protocol, four-party DR 
protocol and extend them into the parallel and serial N- 
party DR protocol which are different in time complexity 
and all loss-tolerant. And the most normal attack that 
may exist to get the bias when those protocols are fair are 
analyzed. Conclusions and open problems are presented 
in Sec. 4. 



II. QND-BASED SEMI-LOSS-TOLERANT 
COIN-FLIPPING PROTOCOL 

The least bias among all SCF protocols considering the 
loss in practice is 0.3536 in ref. [1] showed as follows. 

1. Bob prepares a singlet \ip) = IQaIbMUOb) 
sends particle A to Alice, where the subscripts A and B 
denote the two entangled particles. 

2. Alice randomly selects classical bit a, where a = 
represents that she chooses basis |0), |1) and a = 1 
represents that she chooses basis cos\0) + 5m|l), sin\0) — 
co5|l), then she measures particle A along the basis she 
chooses. 

3. If Alice successfully detects the particle, whose out- 
come is denoted as r^, she asks Bob to proceed the pro- 
tocol, otherwise, she asks Bob to restart the protocol. 

4. Bob sends Alice a randomly selected classical bit b. 

5. Alice informs Bob of her selected a and outcome r^. 

6. Bob measures particle B along the basis that a 
represents. If he successfully detects it, whose outcome 
is recorded as r^, and = r^, he will abort and claim 



Alice is cheating. In all other cases the outcome of the 
coin flipping is given by 6 r ^ • 

However, the protocol in [20| utilizes EPR pairs to 
make the semi- loss-tolerant come true. Considering 
the difficulty of preparing entangled states, we give 
some impressive improvements to get the same result 
and efficiency using Quantum nondemolition (QND) 
measurements [2 1] . 

Replacing the preparation of EPR pairs with QND 
measurements, we make the implementation more acces- 
sible with current technology. 

1. We say of (f{a,x)) that a is the basis and ta is the 
bit which could be showed as follows. 

^ f 1^(0,0)) = |0) f \(Pii,o)) = cosa|0) + sina|l) 

a = < ,a = l< 

[ lv^(o,i)) = |1) [ 1^(1,1)) = sina|0) - cosa|l) 

Alice prepares one state \(p(a,rA)) froiii lv^(o,o)) = 
|0), 1^(0,1)) = 1^(1,0)) = cosa|0) + sina|l), \(P{i,i)) = 
sina|0) — cosa|l) with basis a(0, 1) and bit rA(0, 1) cho- 
sen independently at random, then she sends the single 
photon to Bob. 

2. Bob makes sure that he received this photon using 
QND measurements, keep the received qubit in his quan- 
tum memory storage, and notice Alice about it. Other- 
wise, he will restart the protocol. 

3. Bob sends Alice a randomly selected classical bit b. 

4. Alice informs Bob of her selected single photon 

5. Bob measures the qubit in the quantum memory 
according to Alice's announcing a. If he detects it, whose 
outcome is denoted as r^, and finds that ta ^s, he 
aborts the protocol, calling Alice a cheater. If = 

or even he doesn't detect the qubit due to the probability 
p that the qubit in the Bobs quantum memory storage is 
lost, the outcome of the coin flipping is 6 r^. 



III. N-PARTY LOSS-TOLERANT DICE 
ROLLING PROTOCOL 

Three-party loss-tolerant dice rolling protocol is given 
as follows: 

The first round: Alice and Bob roll the dice accord- 
ing to QND-BASED SEMI-LOSS-TOLERANT PRO- 
TOCOL described above. In the final step, if Bob de- 
tects the qubit, whose outcome is denoted as r^, and 
finds that / r^, he aborts the protocol, calling Alice 
a cheater. If r^i = or even he doesn't detect the qubit, 
the outcome of the coin flipping is 6 r^. Here we can 
suppose that Alice will win the first round if 6 is 
0, and Bob will win the first round if 6 is 1. The 
winner, who can be supposed to be Alice, without losing 
the normality, will join the next competition. 

The second round: Alice and Charlie roll the dice 
based on QND-BASED SEMI-LOSS-TOLERANT PRO- 
TOCOL described above. If Charlie detects it, whose 
outcome is denoted as rc, and finds that 7^ ^c, he 
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aborts the protocol, calling Alice a cheater. If = rc 
or even he doesn't detect the qubit, the outcome of the 
coin flipping is c r^. Here we can suppose that Ahce 
will win the first round if c is 0, and Charlie will 
win the first round if C is 1. The winner is the final 
winner of the three parties. 

The key difference between the protocol in [20^ and 
ours is that we choose two different methods to better 
solve the problem that the qubit-receiver(Bob in our pro- 
tocol) may receive no qubit so that the qubit-sender (Alice 
in our protocol) could announce any result she wants to 
bias the result to what she wants. The protocol in [20| 
chooses to utilize EPR pairs and ours' intention is to 
make it more practical by using one single state with 
QND measurement. The remaining steps of the two pro- 
tocols are equivalent. Consequently our security analysis 
follows directly from the analysis of the protocol in [20|. 

We will show security analysis of three-party loss- 
tolerant dice rolling protocol below. 

DR protocol is fair if and only if 



p* p* p* 



(2) 



according to the definition in [2], with PJ(P^,P^)is 
the maximum probability that party A (B, C) loses. Con- 
sequently, we analyze the following context based on the 
maximum probability of lose. 

What's more, we will be interested in the N "worst 
case" scenarios to maximize the bias, where all but one 
of the parties are dishonest and moreover, are cooperat- 
ing with one another, using the classical and quantum 
communication channels. 

Then we get the bias of three-party loss-tolerant pro- 
tocol: 

It would be relatively easy to realize that our result 
would be the same as Ma's conclusion because except 
the key step of using resources, our protocol could change 
into Ma's model in an equivalent transformation point of 
view. Consequently, Alice would win (or lose) the game 
with the probability of ^^^f^ • (1 - ^^^f^), and Bob 
would win (or lose) the game with ^^"Q' • (1 — 

sma y ^j^^ maximum probability that party 
Bob loses is 

— ^ 1 + cosa 1 + cosa 1 + p + (1 — p) sin /3 

" 2 ^ ^ 2 ^ 2 • 

(3) 

Using the same method, the maximum probability that 
party Charlie loses is 



P* — 1 



1 + p + (1 — p) sina 



(4) 



and the maximum probability that party Alice loses is 



1 + p + (1 — p) sina 1 + p + (1 — p) sina 



1 + p + (1 — p) sin j3 
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FIG. 1: Maximal fair bias is a function of p, it decreases with 
decreasing p, and our optimal bias reproduces the best result. 



On the whole, considering 
is fair iff 



p* 



PX^ this protocol 



arcsm ■ 



2 - 2p + 2 



(6) 



5 — 2p + 

Finally, we can get the bias of this protocol is 



(7) 



2/3(0 ^ J9 ^ l).We can see it 



(5) 



2 
3 

clearly in Curve Simulation(Fig 1). 

A six-round weak three-sided DR protocol is con- 
structed in ^] using three-round weak imbalanced CF 
protocol twice. However, it cannot be loss-tolerant and 
therefore has less practical usage because of the kernel 
CF protocol it uses. Our protocol could be more practi- 
cal and at the same time, safer with a lower bias. 

Assuming that one round of CF in our N-party proto- 
col has the time consumption of where t is a constant. 
Obviously, the parallel and serial three-party DR proto- 
col have the same time consumption 2t. When it comes 
to N-party, where N is more than three, the DR proto- 
col can be divided into parallel and serial ones. We find 
the difference between the parallel and serial DR proto- 
col by analyzing the four-party ones then we extend it to 
N-party in a normal model. 

According to the construction steps introduced in 
three-party, we can get four-party loss-tolerant dice 
rolling protocol which described in Fig 2 and Fig 3. 

Obviously, the parallel and serial three-party DR pro- 
tocol have the same time complexity. We find the dif- 
ference between the serial and parallel DR protocol by 
analyzing the four-party ones so that N-party DR proto- 
col is constructed directly. Serial four-party DR protocol 
showed in Fig 2 has the time complexity 3t while paral- 
lel one in Fig 3 has the time complexity 2t because two 
rounds of DR are executed simultaneously in the parallel 
one. By construction, we can get N-party DR protocol 
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FIG. 2: The model of serial four-party DR protocol. 
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FIG. 3: The model of parallel four-party DR protocol. 



both in the term of serial and parallel one. For N-party, 
the time complexity of parallel one approximately ap- 
proachs Q{logN)t which is smaller than serial one Q{N)t. 



IV. CONCLUSION 

To sum up, we get a semi- loss-tolerant strong quan- 
tum coin-flipping protocol using quantum non-demolition 
(QND) measurement, and obtain the recent best bias of 
0.3536, reproducing the result in [20]. Our protocol is 
advantageous in that, we avoid the difficult implement of 
EPR resources by using the single photon, which could be 
an improvement for the design of coin-flipping protocol. 

To inherited this simplicity, we can easily construct 
more practical three-party and four-party dice rolling 
protocols and drive them into any N-party dice rolling 
protocol, including the parallel and serial ones different in 
time complexity which is demonstrated clearly. We ana- 
lyzed explicit and optimal cheating strategies and proved 
that our protocol is fair, especially when two parties, 
both Alice and Bob have an optimal cheating strategy 
capable of producing their desired outcome with 0.8536 
probability of success (assuming the other player is hon- 
est). When it comes to three parties, the probability be- 
comes 0.23+0.67=0.9 which is also the best result among 
dice rolling protocols considering loss. 

It is necessarily important that we go on to find a 
safer loss-tolerant quantum coin-flipping protocol with 
a smaller bias. 
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